So I've been using Puppy for a long time now, mostly for recovering data and running assorted computers from Live Discs. Now I've stumbled on a rather uncomfortable situation - my laptop has a cracked screen and it's time to send it in before my warranty expires, so now (after fighting with a rather nasty partition table issue for some time) my only functioning computer for the time being is, you guessed it, an older 2Ghz/256 MB desktop running Puppy 5.2 on a hard drive install.

And I have a few questions..

Since Puppy Linux runs as the root user, what steps can I take to secure my system on the other end of the spectrum, namely intrusion-protection?

Since there is no actual need for a potential intruder to install a root-kit in Puppy, how can I take further steps to ensure that nobody gets that far in the first place?

Is there anything I can do similar to AppArmor in other Distros, limiting what certain applications (namely browsers, for one) can and cannot do?

Am I basically limited to running an HIDS/NIDS, encrypting my filesystems and monitoring logs, and praying that a fresh install never becomes necessary?

I've done quite a bit of searching and haven't really found what I'm looking for anywhere else. Yes, you might call me paranoid - but an ounce of prevention is a pound of cure, especially in the CompSec world.

I would really, really appreciate any input you guys might have, maybe point me in the direction of further security measures I can take?

(I do miss the extra layer of security that sudo provides, even if it's but one well-crafted password - but Puppy has always been faithful to me, and 20 distros later, it's the only one that simply *worked*.)

Thanks for the response. Is GROWL viable in 5.2? I'm rather fond of Debian, not so fond of Slackware, thus why I'd prefer to stick to 5.2 if I can. Unless I'm mistaken, each is based off the respective distros.

Also, I understand running from CD is more secure (and have also read the Wiki multiple times) due to the nature of encrypted save files and being able to load a pristine system into RAM, but that doesn't quite suit my needs at the moment.

There seems to be plenty of information on security running from CD, but virtually nothing on enhancing security on a full install to HDD.

*Sigh* Nobody? I know that on a most basic level Puppy is relatively secure, but what I'm looking for are steps that can be taken beyond the most basic level to take my system to a 99.9% Impenetrable status.

If running from LiveCD was a logical option for me, that's exactly what I'd be doing, and what I have been doing for at least the past six months.

Let me put it this way, maybe I can clarify what I'm looking for and what my particular concerns are.

In a successful Penetration Test, the basic steps are:

Information Gathering
Vulnerability Exploitation
Privilege Escalation

In a Puppy system, the third step is eliminated entirely. Once someone finds a vulnerability and exploits it, they have full root access to the system. Running a system 100% as root is therefore very reckless unless steps are taken to prevent an intrusion in the first place.

From what I can gather, Puppy doesn't include any server process by default (and I would very much appreciate that I be corrected on that if I'm wrong). For the average user, this is a true blessing.

But let's imagine for a moment someone who isn't an average user, and still needs/wants to run Puppy (5.2 in this case) from a Full HDD install. For this User, security is a major concern, and they are willing to take every conceivable step to ensure that their system is secure as possible while net-facing. However, they still have no intention of running server processes, so those attack vectors are thereby eliminated.

Let's assume they're already behind two firewalls at maximum security settings, and are looking for ways to further enhance their overall security. Instead of compiling their own system, they've chosen to run Puppy.

What steps could this user take to increase the improbability of a network-based intrusion on their system?

(Thank you in advance to anyone who takes the time to read my somewhat long posts and, hopefully, reply with some advice.)

I was looking for something a little bit beyond GROWL, and I'm actually in the process of implementing it in 5.2 right now, so we'll see what works and what doesn't. From the looks of it, everything should work fine.

The Wiki is perfectly clear, but I'm already past everything it recommends.

Hmm. Honestly, I had forgotten about Spot. I suppose I could run certain things under that user, but I was under the impression that not everything worked properly as Spot?

The dangers of running as root are that anyone who *does* manage to gain access to your system has full control, obviously. While that may be a worst-case scenario, that's the sort of thing I plan for.

*Chuckles* And yes! I have considered running a 3rd and 4th firewall, maybe even a 5th, 6th and 7th! I have no short supply of computers I could dedicate as firewall/routers, so that's not entirely out of the question either.

Basically, is there anything beyond GROWL and more firewalls that I could do? All I'm really looking for is a starting point, I'm sure I can figure the rest out on my own.

I seemed to have turned into some sort of low level security encrustation

Just so you know. I run as root. I install any software that takes my fancy. I usually run the Puppy firewall out of habit. Never bother with GROWL.
What I know about security can be written on the back of a clam shell.

However as you like this sort of thing . . .
The triple dorje (a mysterious lightening device used in Yinyana Buddhism) method of security enhancement may be suitable:

This is a hardware based solution for a firewall.
Basically you rotate between connection methodologies.
With systems booting intermittently into firewalls on multi-session CD preferably on different CPU architectures (again multiple machines).

I can not not tell you exactly how to implement this as it should be bespoke and unique. That should keep you safely occupied for a few years . . . _________________Puppy WIKI

I know nothing about how to set up things secure
but I read something I found interesting.

Some security person got interviewed and told about
his latest approach. He set up a kind of "HoneyPot"
in that what the intruder see does look very real.

What them meet and get feedback on is a virtual thing
that just pretends to be the real thing with secret documents
and so on. The purpuse was to make the intruder satisfied
that them have done the catch of the years and them fully
tied up trying to get those secret documents that are faked
while in the meantime, all the alarm bell should reveal there is
an intruder in the Honey Pot so owner could secure the real files
and feed the intruder with the faked ones.

I have no idea how one do that convincingly or if it works._________________I use Google Search on Puppy Forum
not an ideal solution though

Just so you know. I run as root. I install any software that takes my fancy. I usually run the Puppy firewall out of habit. Never bother with GROWL. What I know about security can be written on the back of a clam shell.

Personally, the main thing I dislike about running as root is that you are essentially giving full permissions to any program that finds it's way onto one's system and tries to execute malicious code. Usually I prefer to run as an administrator or unprivileged user and elevate privileges with sudo for certain tasks. This may be force of habit more than anything, and I can certainly adapt to running as root (I have in the past), but I like to take some precautions along the way. And I also LOVE Bash scripts, so while I won't use most of the features of GROWL, it saves me the effort of writing my own, and I'm very appreciative of that fact. By running my browser as an unprivileged user, anything that might escape "into the wild" on my system doesn't have the permissions needed to do any real harm, effectively sandboxing the browser (though I do prefer adding something like AppArmor into the mix to selectively grant permissions).

Now that I've rambled on for a while, I must say that I do like this sort of thing. I like to know how things tick, down to every last 0 and 1 of binary when possible.

Quote:

This is a hardware based solution for a firewall.
Basically you rotate between connection methodologies.
With systems booting intermittently into firewalls on multi-session CD preferably on different CPU architectures (again multiple machines).

I can not not tell you exactly how to implement this as it should be bespoke and unique. That should keep you safely occupied for a few years . . . Cool

I love it! I may have to give something like that a try. Though with any luck, it'll only keep me busy for a few months. Just enough time to build a hardened Linux supercluster to use it on (and then try and break into it, dodging lasers and retina scanners galore).

Nooby wrote:

Some security person got interviewed and told about
his latest approach. He set up a kind of "HoneyPot"
in that what the intruder see does look very real.

Basically, I think what you're describing is very close to what Lobster was describing earlier. Essentially you set up a "dummy" system that the bees can't resist but to swarm around, have an alarm in place to notify you when they do, and while the swarm is busy investigating what looks like a goldmine (I kinda picture Winneh the Pooh here ), you take care of more important matters - like securing the "real" system.

Very similar to what happens with Proxy servers from time to time. Someone sets up an inconspicuous server (in the case of a Proxy, you want it to seem fairly innocent) and then gathers data of all those who route traffic through that Proxy. Kinda reversed, but the same sorta idea.

Yes I trust that is what the "Faked Hot Spots for Wifi" do to.
Them being Man in the Middle while the innocent user of open wifi have no clue.

So it can be used both way. Like any tool. Tool do what the user make of them.
For good purpose or for bad purpose an ax can build cabins and
hit people to hard.

Back to your topic. Them the Devs of Puppy made an attempt
to give somewhat to the worried Linux users that are used to
be in a multi user environ where one only are root when one
need to do serious admin things.

So Barry came up with Fido as the user that is not Admin but
still being in a single user environ where one can boot into Root.

You have at least two or three? threads about Fido but nothing
came out of it.
I trust that Puppy lovers are so used to being root that then have
no inner motivation to give this too much effort. So maybe you
are that person then?

Look for threads on Fido and Barry and Micko here in forum?
And on Barry's Blog

oops forgot. One guy care about security? Him made a more secure
version of Lupu 528. Now already I ahve forgotten his user name.
Oh could be this one with DPUP5520

Then there is such tricks like taking out the HDD and using an adapter
that allow the internal to be like a USB connected external HDD and
that way one boot from CD or USB and save to usb but only run in
RAM so the intruder need to mount the USB and that maybe can be set
up so one get alarm when them do it?

Some do away with the pupsave file and feel secure that way?_________________I use Google Search on Puppy Forum
not an ideal solution though

Sounds ideal. In future I will know where to send the security conscious.
I hope you can offer Leaena further support as I have the security acumen of a fish in treacle.

Something you might know . . .
The biggest threat for me is downloading large files from dodgy sites, using an outdated bit torrent.
These sites, such as pirate bay, seem to be using some sort of sending bot that probes and writes new directories in root.

The directories are always empty and may be bad code from an earlier Transmission used in Slacko. I suppose I could run as Spot for a while . . . or cut down on visiting dodge city . . .?
Fatdog had a great policy of only downloading to 'Downloads', that might have helped . . . ?
Anyway I mention it in passing as I should know better than visiting such sites . . . _________________Puppy WIKI

There is a way to easily encrypt and hide torrent transmissions, unfortunately you cannot do it with Transmission as far as I know however I intentionally left the bit-torrent client in PuppyCrypt unsecured in order to divert illegal intentions._________________PupRescue 2.5Puppy Crypt 528

You cannot post new topics in this forumYou cannot reply to topics in this forumYou cannot edit your posts in this forumYou cannot delete your posts in this forumYou cannot vote in polls in this forumYou cannot attach files in this forumYou can download files in this forum